Microsoft Azure PrivateDnsManagementClient
Browse all Azure APIs★ Only Publicly Available OpenAPI DocumentCloud InfrastructureNetworkingoauth217 EndpointsREST
For Agents
Provision and manage Azure Private DNS zones, link them to virtual networks, and create or update DNS record sets for private name resolution inside Azure.
Use for: Provision a new Azure Private DNS zone in a resource group, Link an Azure Private DNS zone to a virtual network, Create an A record for a service in a Private DNS zone, List all record sets of type CNAME inside a Private DNS zone
Not supported: Does not manage public DNS zones, network security groups, or virtual network creation — use for Microsoft.Network Private DNS zones, virtual network links, and record sets only.
Jentic publishes the only available OpenAPI specification for PrivateDnsManagementClient, keeping it validated and agent-ready. The API manages Azure Private DNS zones under Microsoft.Network — the private name resolution surface used to resolve hostnames inside Azure virtual networks without exposing them publicly. It covers the zone lifecycle, virtual network links that bind zones to VNETs, and the full set of record sets (A, AAAA, CNAME, MX, PTR, SOA, SRV, TXT) that hold the records inside each zone.
Install Jentic One Beta
Connect the PrivateDnsManagementClient to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the PrivateDnsManagementClient, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Capabilities
What an agent can do with PrivateDnsManagementClient API.
Provision a Private DNS zone in a resource group
Link a Private DNS zone to one or more Azure virtual networks
Create or update DNS record sets of any standard type inside a zone
List record sets in a zone, optionally filtered by record type
Delete a Private DNS zone or any of its record sets
Inspect virtual network link configuration and registration state
Use Cases
Patterns agents use PrivateDnsManagementClient API for, with concrete tasks.
★ Private name resolution inside Azure VNETs
Teams that run internal services in Azure need to resolve hostnames privately without exposing them to the public internet. The API provisions a Private DNS zone, links it to the consuming virtual networks, and lets services register A and CNAME records that other workloads in the same VNET can resolve directly.
Create the Private DNS zone 'corp.internal' in resource group 'network-rg' and link it to virtual network 'vnet-prod' with auto-registration enabled
Service discovery via DNS record sets
Microservices in a private VNET often use DNS for service discovery. The API supports the full set of record types (A, AAAA, CNAME, MX, PTR, SRV, TXT) so agents can register endpoints, rotate them on deploy, and remove them on teardown without touching public DNS.
Add an A record 'orders' pointing to 10.20.30.40 in the 'corp.internal' Private DNS zone with a 60-second TTL
VNET link lifecycle management
When a new environment VNET is provisioned, it needs to be linked to existing Private DNS zones so workloads can resolve internal hostnames. When the VNET is decommissioned, those links should be torn down. The API exposes per-link create, get, update, delete, and listing endpoints to manage this lifecycle programmatically.
List all virtual network links on the 'corp.internal' Private DNS zone and delete any pointing to VNETs in resource group 'sandbox-rg'
Agent-driven DNS automation
An AI agent fronting a platform engineering portal accepts service registration requests and creates or updates the matching Private DNS records, links new VNETs to the zone on demand, and cleans up records when services are retired. Jentic isolates the Azure AD client secret so the agent only sees scoped bearer tokens.
Given a service name and target IP, create the A record in the appropriate Private DNS zone and verify the record is resolvable
Key Endpoints
17 endpoints — jentic publishes the only available openapi specification for privatednsmanagementclient, keeping it validated and agent-ready.
METHOD
PATH
DESCRIPTION
PUT
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/privateDnsZones/{privateZoneName}
Create or update a Private DNS zone
GET
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/privateDnsZones/{privateZoneName}
Get a specific Private DNS zone
DELETE
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/privateDnsZones/{privateZoneName}
Delete a Private DNS zone
GET
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/privateDnsZones/{privateZoneName}/ALL
List all record sets in a zone
PUT
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/privateDnsZones/{privateZoneName}/virtualNetworkLinks/{virtualNetworkLinkName}
Create or update a virtual network link
DELETE
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/privateDnsZones/{privateZoneName}/virtualNetworkLinks/{virtualNetworkLinkName}
Delete a virtual network link
GET
/subscriptions/{subscriptionId}/providers/Microsoft.Network/privateDnsZones
List all Private DNS zones in a subscription
PUT
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/privateDnsZones/{privateZoneName}
Create or update a Private DNS zone
GET
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/privateDnsZones/{privateZoneName}
Get a specific Private DNS zone
DELETE
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/privateDnsZones/{privateZoneName}
Delete a Private DNS zone
GET
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/privateDnsZones/{privateZoneName}/ALL
List all record sets in a zone
PUT
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/privateDnsZones/{privateZoneName}/virtualNetworkLinks/{virtualNetworkLinkName}
Create or update a virtual network link
DELETE
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/privateDnsZones/{privateZoneName}/virtualNetworkLinks/{virtualNetworkLinkName}
Delete a virtual network link
GET
/subscriptions/{subscriptionId}/providers/Microsoft.Network/privateDnsZones
List all Private DNS zones in a subscription
Why Jentic?
Three things that make agents converge on Jentic-routed access.
Credential isolation
Azure AD OAuth 2.0 client credentials are stored encrypted in the Jentic vault. Agents receive a scoped bearer token at execute time; client secrets and refresh tokens never reach the agent's context.
Intent-based discovery
Agents search by intent (e.g., 'create azure private dns A record') and Jentic returns the matching record-set operation with the zone name, record-type segment, and record body parameters resolved from the spec.
Time to first call
Direct integration with the Microsoft.Network Private DNS API, including AAD setup and VNET-link async polling, typically takes 1-2 days. Through Jentic: under 1 hour to first successful zone or record-set change.
Related APIs
Alternatives and complements available in the Jentic catalogue.
FAQs
Specific to using PrivateDnsManagementClient API through Jentic.
Why is there no official OpenAPI spec for PrivateDnsManagementClient?
Microsoft Azure does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call PrivateDnsManagementClient via structured tooling. It is validated against the live API and kept up to date. Get started at https://app.jentic.com/sign-up.
What authentication does the Azure Private DNS Management API use?
The API runs through Azure Resource Manager and uses OAuth 2.0 bearer tokens issued by Azure Active Directory under the azure_auth scheme with the user_impersonation scope. Through Jentic, the AAD client secret is held in the encrypted vault and a short-lived access token is supplied at execute time so the secret never appears in the agent's context.
Can I link a Private DNS zone to multiple virtual networks?
Yes. Each VNET link is its own resource at PUT .../privateDnsZones/{privateZoneName}/virtualNetworkLinks/{virtualNetworkLinkName}, so you can attach the same zone to many virtual networks and choose per-link whether auto-registration of VM A records is enabled.
What are the rate limits for the Private DNS Management API?
Azure Resource Manager applies subscription-level read and write throttles (around 12,000 reads per hour and 1,200 writes per hour per region per subscription) and returns 429 with a Retry-After header when exceeded. VNET link operations are long-running and should be polled with backoff.
How do I add an A record through Jentic?
Search Jentic for 'create azure private dns A record', load the schema for PUT .../privateDnsZones/{privateZoneName}/A/{relativeRecordSetName}, then execute with subscriptionId, resourceGroupName, the zone name, the relative record name, and the ARecords array. The pip install jentic Python SDK uses the async search, load, execute pattern.
Is the Private DNS Management API free?
There is no per-call charge for the management API itself; you pay for the Private DNS zones (per zone per month) and DNS queries served by the zone. Reads against the management plane are not separately metered.
GET STARTED